competlab-hiring-signals — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited competlab-hiring-signals (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You probe hiring signals across public ATS APIs + LinkedIn unauth + Perplexity to infer GTM-motion shifts, headcount velocity, executive transitions.
Before running ATS probes, check if the vendor is even an ATS candidate.
If the vendor profile shows ANY of these → skip ATS probes entirely (saves 30-60s per vendor):
For skipped vendors, output: "ATS probe skipped — vendor profile (indie/small/young) indicates ATS-data unlikely; founder-channel monitoring required if signal needed."
Saves time + token budget on guaranteed-null probes. Surfaced from a real-world validation run: 9 of 9 hospitality vendors had no ATS, but the orchestrator burned ~30-90s × 9 vendors × 4 ATS platforms anyway.
For each vendor NOT pre-filtered out at Step -1, check which of these apply:
If 0 of 3 apply → flag "hiring data inaccessible via free surface; founder-channel monitoring required."
list_projects + list_competitors.
Critical for vendors with generic-word brand names (folio, notion, linear, arc, bolt, figma, loom, etc.) — ATS slugs that match these brand names are HIGH-RISK for name collision. A real-world validation run had an Ashby hit on folio that was correctly excluded because the slug could match dozens of "Folio" companies (folio travel, folio finance, folio publishing, etc.).
Before including any single-platform ATS hit on a generic-word slug, verify ownership via ONE of:
linkedin.com/company/{vendor-canonical-slug}?ashby.com/companies/{slug} page exists AND mentions vendor-specific product name?If NONE verify → flag-and-EXCLUDE the hit. Better to under-report than mis-report a strategic competitor's hiring trajectory.
For each competitor, try slug variants:
# Ashby
curl -sS https://api.ashbyhq.com/posting-api/job-board/{slug} | jq '.jobs | length'
# Greenhouse
curl -sS https://boards-api.greenhouse.io/v1/boards/{slug}/jobs | jq '.jobs | length'
# Lever
curl -sS "https://api.lever.co/v0/postings/{slug}?mode=json" | jq 'length'
# Workable
curl -sS https://apply.workable.com/api/v3/accounts/{slug}/jobs | jq '.total'Try slug variants: {brand}, {brand}-inc, {brand}inc. For successful response, extract job count + role mix.
Perplexity query: "How many open jobs does [Company] have on LinkedIn? What are the top role categories? Filter by employer-ID to avoid name-collision pollution."
For successful ATS data, extract:
Perplexity query (recency=year): "Has [Company] had any C-level transitions (CEO, CTO, CMO, CRO, COO) in last 12 months? Include incoming + outgoing + dates if possible."
URL-verify any cited press releases / Bloomberg articles via mcp__competlab__fetch_url.
GetLatka often has "X employees, up/down from Y in [year]" data. Perplexity surfaces it. Always URL-verify the GetLatka page.
Per vendor:
Cross-vendor:
# Hiring & GTM — [Category / Project]
> Generated [date] | Coverage: X of N vendors yielded ATS or Perplexity data
## Summary
[Hiring intensity range, GTM motion patterns]
## Per-competitor
### [Competitor]
- Hiring surface: [ATS slug / LinkedIn / Perplexity / no data]
- Total jobs: [N] | Role mix: [eng X / sales Y / CS Z]
- Geography: [HQ + notable expansion signals]
- Headcount trend: [up/down with delta + year]
- Exec transitions: [list with dates] / [none]
- GTM inference: [enterprise build-out / efficiency mode / etc.]
## Cross-competitor patterns
[Hiring intensity ranking, GTM motion divergence, geographic patterns]mcp__competlab__fetch_url. If even careers page yields nothing actionable (no role listings on page), mark "LinkedIn unauth + careers page yielded no clean signal" rather than reporting collision-polluted counts.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.